netdev - Re: [PATCH net] route: add rcu_read_lock when lookup route and update fnhe in __ip_do

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 01 Feb 2016 05:46:47 -0800
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Xin Long <lucien.xin@...il.com>
Cc:	network dev <netdev@...r.kernel.org>, davem@...emloft.net,
	hannes@...essinduktion.org
Subject: Re: [PATCH net] route: add rcu_read_lock when lookup route and
 update fnhe in __ip_do_redirect

On Mon, 2016-02-01 at 18:22 +0800, Xin Long wrote:

> But there may be an issue in __ip_do_redirect():
>          } else {
>              if (fib_lookup(net, fl4, &res, 0) == 0) {
>                  struct fib_nh *nh = &FIB_RES_NH(res);
> 
>                  update_or_create_fnhe(nh, fl4->daddr, new_gw,
>                                0, 0);
>              }
> 
> Which is not running in rcu_read_lock(), it may update a fnhe that
> has been freed.
> 
> So fix it by adding rcu_read_lock() just like other parts.

But the whole __ip_do_redirect() needs to be called from rcu_read_lock()
already.

No need to add another rcu_read_lock() around fib_lookup()

How did you come doing this patch ? Any particular stack dump or
something ?